Run workflow Agents through XMD-mediated observations

[taras]

Story

As a workflow user, I want an Agent to inspect retained work only by asking XMD for observations, so the workflow can use Agent judgment without giving the Agent a Workspace materialization, additional directories, or a direct mutation path.

Initial delivery contract

A workflow Agent receives no Workspace checkout, read-only materialization, ACP additionalDirectories, or host path. Its provider session starts in an empty disposable cwd with no configured MCP servers. The host requests allowedTools: [] when the selected adapter supports it and installs deny-all permission policy.

The first delivery does not claim that every ACP adapter proves tools are absent. The system prompt requires constrained XMD output, and any native tool permission request is denied and fails the turn explicitly. #496 owns portable adapter-level no-tool enforcement and does not block this story.

The Agent inspects retained work through a bounded loop:

1. The Prompt asks the Agent to return an exact XMD observation request.
2. Evaluate Agent-generated XMD through a constrained allowlist #369 preflights the complete fragment against a host-owned allowlist of pinned read-only component identities and the exact retained Workspace roots the request may address.
3. XMD executes the admitted observations through ordinary durable effects.
4. The retained results are supplied to the same Agent session in the next Prompt.
5. The loop continues until the Agent returns its final XMD proposal or the authored attempt bound is exhausted.

The Agent output carries no authority to add a Workspace root, component identity, environment value, credential, native command, or network destination. The trusted workflow host supplies those ceilings independently of the generated source.

This story owns the workflow Agent session, the request/result turn loop, retained session mapping, cancellation, and compatible reattachment. #369 owns generated-XMD parsing, admission, execution, retention, and replay.

Ordinary xmd run keeps its caller-selected Agent permission behavior.

Acceptance

• A workflow Agent completes a multi-turn inspection using only generated XMD observation requests and retained XMD results.
• The Agent receives no Workspace materialization, ACP additionalDirectories, or Workspace/host path as cwd.
• The workflow provider requests an empty allowed-tool set when supported, configures no MCP servers, and installs deny-all permission policy.
• A native tool permission request is denied and fails the turn explicitly rather than silently widening authority.
• The initial contract identifies tool suppression as best-effort across adapters and points to Require ACP adapters to enforce tool-free workflow Agent sessions #496; it does not claim portable no-tool enforcement.
• A generated request cannot add or replace its host-supplied Workspace roots or pinned component identities.
• Completed replay restores Prompt, request, and observation results without launching an Agent or repeating reads.
• Partial replay reattaches a compatible provider session when supported or reports explicit incompatibility.
• Scope-owned processes, sessions, streams, and disposable cwd state finish teardown on success, failure, and cancellation.
• Session identity and compatible resumption survive process restart without hidden transcript-only state.
• Attempt exhaustion follows the authored workflow policy and retains the evidence that produced it.
• Final generated mutations use Evaluate Agent-generated XMD through a constrained allowlist #369's mutation-proposal admission rather than a writable Agent channel.
• Architecture, ACP, workflow, and executable-MDX specifications describe the mediated MVP and its Require ACP adapters to enforce tool-free workflow Agent sessions #496 limitation.

Dependencies

• Evaluate Agent-generated XMD through a constrained allowlist #369 slice 1 supplies constrained read-only observation admission before this loop can inspect retained work.
• Add named Repository and Worktree composition #293 supplies retained Repository and Worktree identities consumed by the host-owned request ceiling.
• Add the xmd workflow start/resume filesystem vertical slice #366 and Add workflow inspection, cancellation, suspension, and deletion #367 supply retained workflow execution, lifecycle ownership, cancellation, and resume.
• 🌐 Fetch retained HTTP observations from Markdown #456 supplies retained HTTP observations when the generated allowlist admits the pinned Fetch identity and bounded request.
• Require ACP adapters to enforce tool-free workflow Agent sessions #496 is a non-blocking hardening follow-up.
• End goal: ✨ Compose and certify the supervised adversarial implementation workflow #181.

Out of scope

• Direct Agent access to a Workspace materialization.
• ACP additionalDirectories or Agent.AddDir.
• Claiming portable adapter-level no-tool enforcement in the initial delivery.
• Giving generated source authority to select roots, components, credentials, or network destinations.
• A writable Agent channel.
• Unattended iteration or another workflow executor.